How to use Codex code review on GitHub and in the CLI

How to set up Codex code review on GitHub

1. Connect Codex to GitHub and give it access to the repositories you want reviewed.
2. Request a review by commenting @codex review on a pull request. Codex reacts with 👀 while it works, then posts its review.
3. Review every pull request by turning on Automatic review under Personal preferences; it no longer needs the comment. Use Review trigger to choose which pull request events start a review.
4. Add review rules to AGENTS.md (see below) so Codex checks what your team cares about.

Turning on automatic review for a repository in Codex settings also needs push or admin permission on that repository. You can narrow a single review by adding a focus to the comment, for example @codex review for issues in the database migration.

A deeper Codex security review is in research preview. Comment @codex security review to request one, or turn on Auto security review and set it to run whenever code review runs. It uses the diff, the repository and any threat models you’ve configured, and its findings can overlap with the regular review’s.

What a Codex review looks like

Codex posts a standard GitHub pull request review, the way a teammate would. Each comment sits on the relevant diff lines, describes the problem and carries a priority label in its title, such as [P1] Approving MCP tools never notifies the server.

On GitHub, Codex flags only P0 and P1 issues, so comments stay on the highest-priority risks. A quiet review means no severe problems were found, not that the change has no problems: lower-priority issues simply aren’t reported.

To act on a finding, reply on the pull request with a task, such as @codex fix the P1 issue. Codex starts a task with the pull request as context and can push the fix to the branch if it has permission. Review the pushed commit like any other change.

How to review locally with the Codex CLI

In the Codex CLI, type /review to open the review menu. It offers four presets:

• Review against a base branch (PR style), for the whole branch before you open a pull request.
• Review uncommitted changes, for what you’re working on now.
• Review a commit, for the change set of one commit.
• Custom review instructions, to steer the review toward what you care about, such as edge cases or security.

Codex reports prioritized findings and doesn’t modify your working tree, so you can fix issues before you commit or open a pull request. The review focuses on behavior changes and missing tests. Run /diff afterwards to see the exact file changes, and ask Codex to apply fixes when you’re ready; your usual sandbox and approval settings apply.

/review appears only inside a Git repository. It uses the session’s current model unless you set review_model in config.toml, which lets you review with a different model from the one that wrote the change.

How to write review guidelines in AGENTS.md

Codex searches the repository for AGENTS.md files and applies the code review rules that cover each changed file. Add a ## Code Review Rules section to the file closest to the code it governs, and use ### headings to group related checks. Keep each rule short and checkable against the code:

## Code Review Rules

### Money
- Store amounts as integer cents, never floats.
- Safe path: convert to a decimal string only when formatting for display.

### Data access
- Every API handler scopes queries to the caller's workspace.
- Never log tokens or full request bodies.

OpenAI suggests starting with two or three concise rules, saying what the safe path or the allowed exceptions are, and describing outcomes rather than function names that can change. Leave formatting and lint checks to CI, where they’re enforced on every run.

How nested AGENTS.md files apply

Put repository-wide rules in the root AGENTS.md and service-specific rules in a nested file, such as services/billing/AGENTS.md. For each changed file, Codex applies the root rules plus the more specific guidance from files closer to it. A change in the billing service gets both sets; a change elsewhere gets only the root rules.

Rules guide the review, but they don’t replace tests, branch protection or required approvals. Treat anything that must hold on every merge as a CI check.

Rules like these work better than general advice such as “write clean code,” because a reviewer can point to the exact line that breaks them. The same file serves other tools: HeyDeer reads AGENTS.md as well as REVIEW.md, so one set of rules guides the agent that writes the code and every reviewer that checks it. See how HeyDeer applies review rules.

Plans, pricing and usage limits

Codex is included in ChatGPT Free, Go, Plus, Pro, Business, Edu and Enterprise. On OpenAI’s pricing page, Plus ($20 a month) lists automatic code review among its cloud integrations, along with Codex on the web, in the CLI, in the IDE and on iOS. Business costs $20 per user a month billed annually, or $25 billed monthly, for two or more users.

Codex Code Review usage applies only when Codex reviews through GitHub, such as when you tag @codex on a pull request or turn on automatic reviews. A review you run locally with /review counts toward your general Codex usage limits instead. Using Codex with an API key gives you no cloud features, so GitHub code review isn’t available that way. (Source: OpenAI Codex pricing docs, checked November 2026.)

Limits depend on the model, the size of the task and whether it runs locally or in the cloud, and cloud tasks use more of your allowance. Plus and Pro users can buy extra credits once they reach their included limits, and Business, Edu and Enterprise workspaces on flexible pricing can buy workspace credits.

When Codex review isn’t enough

• Only the most severe issues. Flagging just P0 and P1 keeps noise down but leaves medium and low issues unreported.
• The author reviewing itself. When Codex wrote the change, a reviewer built on a different model can catch what it missed.
• Mixed teams. If people and several agents write code, an independent reviewer keeps every pull request reviewed the same way.
• Reviews wait for a trigger. Without automatic review, Codex reviews a pull request only when someone asks.

Claude Code has a similar setup, a local review command plus GitHub reviews; our guide to the Claude Code review skill walks through it.

How to pair Codex with an independent reviewer

A practical split: run /review in the CLI while the change is still local, then let an independent reviewer check the pull request on GitHub. HeyDeer posts its findings as a pull request review with an inline comment on the lines each finding is about, and labels every finding Critical, High, Medium or Low, so issues below Codex’s P1 cut-off still show up.

HeyDeer reads the same AGENTS.md, so the rules you wrote for Codex carry over. Put guidance that only matters in review, such as what to leave alone or how serious a kind of issue is for your team, in REVIEW.md. It double-checks each finding against the code, and you can choose findings to fix: HeyDeer opens a fix pull request against your branch, and a follow-up review checks the result.

See the best AI code review tools ranked by precision, or learn how AI code review works.

Sources

1. OpenAI Codex docs: GitHub integration and code review
2. OpenAI Codex docs: code review
3. OpenAI Codex docs: Codex CLI
4. OpenAI Codex docs: pricing
5. OpenAI Codex docs: CLI slash commands